The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability (CWE-787) in its real-mode hook handler implemented in napoca/kernel/handler.c. The handler calculates an offset from guest-controlled SS:SP registers to index into a 1MB RealModeMemory buffer without validating bounds. When SS=0xFFFF and ESP=0xFFFF, the offset reaches 0x10FFEF, exceeding the buffer size by 65,519 bytes. This causes the IRET frame push operation to write past the buffer's end into the hypervisor heap, potentially corrupting memory. The product is end-of-life and unsupported, and no patch or remediation level is provided by the vendor.

This vulnerability allows a local attacker with low privileges to cause out-of-bounds writes into the hypervisor heap, which may lead to memory corruption, instability, or potentially arbitrary code execution within the hypervisor context. Given the high CVSS score of 8.5 and the nature of the vulnerability, exploitation could severely impact the confidentiality, integrity, and availability of the hypervisor and hosted virtual machines. However, no known exploits are reported in the wild.

The product is end-of-life and unsupported, and no official fix or remediation is available. Users should consider discontinuing use of the affected Bitdefender Napoca bare-metal hypervisor or isolating it from sensitive environments. Monitor vendor communications for any updates, but currently, patch status is not confirmed—check the vendor advisory for any future remediation guidance.